Shopify App Store News, October 2026: Fall ’26 Edition & Security

Published November 2026. Updated monthly. What changed across Shopify in October: the platform updates, the deadlines and the App Store moves that matter whether you run a store or build apps for one. Plus what app teams asked operators on our own platform.

October 2026 at a glance: Fall ’26 Edition: 150+ updates on October 28 · Fake checkouts via app scripts from October 10, redirect protection from October 20 · Google AI Mode and Gemini checkout on by default for eligible stores · Knowledge Base app closes January 15, 2027 · Public apps need expiring offline tokens by January 1, 2027 · 21 new app team projects on our platform, led by paid marketing

October was supposed to be the calm month before peak season. Instead it brought the biggest Edition of the year and a security scare that started inside apps merchants already trusted. Start with the first section. Every store that runs apps on its cart or checkout should check its own setup before Black Friday.

What happened with the Shopify checkout hijacks?

Starting October 10, shoppers on some Shopify stores clicked Checkout and landed on a lookalike page that captured their card details. They were then forwarded to the real checkout, so the order went through and nothing looked wrong in the admin. A developer spotted it when a store’s checkout showed the wrong domain in his address bar.

In the cases researchers documented, the merchant’s theme was clean. The malicious code came through the settings of installed apps, loaded at runtime from the app vendors’ own servers. Several apps were pulled from the App Store or switched off while their developers investigated, and some vendors confirmed unauthorized scripts and brought in outside security firms.

Shopify responded on two fronts. On October 20, online stores started asking shoppers to confirm before leaving for an outside website. Merchants pushed back when it fired on their own partner links, and on October 23 Shopify narrowed it: links to sites it identifies as malicious are now blocked, only suspicious ones trigger a warning, and everything else goes straight through.

The second front was developers: Shopify told them to act that week, which the app section below covers. Jon Kennedy, our founder, called Shopify’s response the right direction, adding in the ShopOps Weekly newsletter that “it isn’t finished”. His point to merchants was simple: any app that runs on your cart or checkout is part of how you take payments.

What to check now. Test your checkout in a fresh private window, several times, and confirm you land on your own checkout domain. Go through your app embeds and remove any app you no longer use. Look for app settings that accept custom code. And turn on two-step authentication for every staff account and every app login.

What’s in Shopify’s Fall ’26 Edition for your store?

Shopify released its Fall ’26 Edition on October 28 under the theme “Exponential”, with more than 150 updates. Most of it points one way: AI that works on your store, and AI agents that buy from it. The parts most stores will feel first:

• Sidekick, rebuilt. It now runs calculations, writes code, searches the web and remembers what you teach it, and you approve its changes. It can test storefront changes on simulated shoppers before suggesting them, and it now draws on data from supported apps. Shopify says daily Sidekick sessions are up 4.2x year on year.

• Canvas. Launched October 1, Canvas shows every page of your store in one workspace you edit with Sidekick. Check the limits before you move a live theme: themes edited in Canvas stop getting theme updates, and app blocks and app embeds aren’t supported yet.

• Shopify Protect. Fraud blocking at checkout, automated help with chargebacks and a rule builder for your own fraud rules, at no extra cost for Shopify Payments users. Shopify lists several features as rolling out soon, so check what’s live on your store.

• Seven new local payment methods in Shopify Payments: Alipay, WeChat Pay, MB WAY, OXXO, Satispay, Scalapay and GrabPay.

• POS customer recognition. POS can now recognize more in-store shoppers through Shopify Payments. Shopify cites over 60% higher lifetime value for known in-store customers.

• Shop Promise. A free program for eligible US stores that shows delivery and returns badges on product pages, at checkout and in the Shop app.

Jon’s read of the Edition as a whole was that “your store is now reachable from places you don’t control”. The next section is what that looks like in practice.

Is your store selling in Google AI Mode and Gemini?

If it’s eligible, probably yes. Shoppers can now buy inside Google AI Mode and the Gemini app through a Shopify-powered checkout. Direct checkout is active by default for eligible stores and is rolling out gradually to customers in the US, Canada and Australia. Your store can be based anywhere.

Eligibility runs through Google Merchant Center, usually via the Google & YouTube channel with product and shipping sync on, plus completed terms, privacy and refund policies. Subscription-only products, bundles, customizable products and B2B-only products aren’t supported, and neither are local delivery or pickup.

The tracking catch is the same one Meta brought in September: your Google Analytics and custom pixels won’t record these orders. There are no extra fees beyond payment processing. To keep shoppers on your own checkout, turn off “Allow Shopify to manage for me” under Sales channels, Agentic, then switch off direct checkout for Google AI Mode and Gemini. Your products stay discoverable.

Agents got more ways to buy, too. Shop Pay now works inside personal AI agents, starting with Muse from Meta, Claude Duet and Instinct. And since October 9, compare-at prices are shared with agentic channels through Shopify Catalog, so agents can show your sale prices.

What do AI agents know about your store now?

Whatever your knowledge base says. On October 26, Shopify moved the knowledge base into the admin under Sales channels, Agentic, Knowledge base. Shopify drafts facts about your store from your published pages, such as contact details and gift services, and each stays unpublished until you approve it.

The standalone Knowledge Base app closes on January 15, 2027. If you used it with fewer than 1,000 facts, they’ve already moved over and been published. If you had more than 1,000, they didn’t move, and you’ll need to add the ones you want to keep before January 15. Either way, read what’s published before agents answer Black Friday questions with it.

What changed for Q4 operations?

Mostly the tools you’ll lean on in November. Rollouts now cover discounts (October 2) and catalog prices and availability (October 23), so you can schedule a Black Friday offer alongside a theme and checkout change. Rollouts are available from the Basic plan, and experiments that split traffic need the Grow plan or higher.

Fulfillment got faster ahead of peak. You can now fulfill orders in batches (October 16), and Shopify Flow can buy shipping labels automatically for orders that match your conditions (October 15). Stock counts can be scheduled, assigned to staff and reviewed in the admin before levels update (October 20), and purchase orders have their own Analytics reports (October 6).

Two compliance changes landed too. Since October 23, Shopify Tax calculates tax on US return shipping fees, so remove any manual workaround. And if you ship to the EU, Shopify Shipping and Managed Markets labels now support the product identifiers EU customs requires on parcels from November 1.

What else changed on Shopify in October?

• Automated store policies (October 8). Return, shipping, contact and terms policies can now stay in sync with your store settings. You’re still responsible for compliance.

• Translate & Adapt auto-sync. Weekly translations for up to 8 languages, for EU merchants (October 9) and US and Canadian merchants (October 27).

• WhatsApp automations (October 28). Shopify Messaging can send automated WhatsApp messages for abandoned carts and checkouts.

• Variants on the product page (October 29). Edit variants without opening a separate page, plus GTIN suggestions checked against the GS1 registry.

• Checkout tweaks. A compact tiled layout for payment methods (October 22) and a single “Terms and policies” footer link (October 26).

• Admin and app. The admin now supports Arabic, Urdu and Hebrew (October 2), and the Shopify mobile app got a faster redesign (October 13).

• App activity in Analytics (October 28). Events from supported apps, such as emails sent or rewards redeemed, now show up in Shopify Analytics.

What does October mean for your store?

A few checks before Black Friday. Test your checkout in a private window and remove apps you don’t use. Choose deliberately whether Google and Meta can sell through their own checkouts, and check that server-side events will capture those orders. Read every fact in your knowledge base before you publish it. And schedule your offers in Rollouts now, not on the morning of the sale.

You run the stores these changes land on. App teams want to hear how it goes.

App companies book paid calls with operators, from $50 to $500 each, to learn how a month like this one plays out in a real store. Your apps, your checks and your Q4 plans are what they want to hear.

See how operator calls work →

What does October mean for Shopify app teams?

Security moved from advice to deadlines. On October 20, Shopify asked developers to act that week: run the new AI Toolkit security check, move to expiring access tokens, treat all rendered data as untrusted, review API logs and turn on two-step authentication everywhere. Shopify also plans tighter limits on storefront app code and higher App Store security requirements, with timelines to come.

The token deadline is fixed. Public apps that call the Admin API must use expiring offline access tokens by January 1, 2027. Apps that haven’t migrated are delisted and blocked from new installs that day, merchants see a warning from January 15, and from April 1, 2027 requests with non-expiring tokens return errors. The later dates aren’t extra time.

New optional protections came with it: an IP allowlist for Admin API calls, a network access section in your app config to declare the servers your app talks to, and credentials-based token recovery. Merchants also now see more about any partner asking for collaborator access, including how long the account has existed and roughly how many stores it works with.

Getting into the merchant’s day just got more open. App Events let your app’s activity show up in Shopify Analytics, where merchants can report on it next to their sales, and Sidekick suggestions now draw on data from supported apps. Polaris 2.0 is stable, and Built for Shopify apps still have until May 1, 2027 to align their App Home with the new admin.

Smaller changes worth a calendar note:

• Local-currency prices. Since October 28, App Store prices show as estimates in 14 billing currencies. You still price in USD, but update any support content that shows plan prices.

• Plan targeting. Public app plans can now require store features, so incompatible stores can’t subscribe to them.

• Canvas. Themes edited in Canvas don’t support app blocks or app embeds yet. If your app depends on them, expect support questions.

• API 2026-10. Exclusive timestamp filters now skip the full second, new carrier services no longer join the General shipping profile, and segment queries use MATCHES and NOT MATCHES.

• Global Catalog REST API. It stopped serving traffic on November 2. Move to Global Catalog MCP.

The market is still growing underneath all this. Shopify says merchants installed 21 million apps in 2025, up 19.5% on 2024. Most of those apps run on trust: when ShopOps Weekly asked readers when they last checked what their apps load onto the storefront, 41% said only at install, and 9% keep a record and review it.

Building for the App Store? Ask merchants what they need before you ship.

The fastest way to know whether a feature, a price or a security change lands well is to ask the merchants who’d use it. Find vetted Shopify operators who match your ideal customer, and book paid research or sales calls in days.

Talk to Shopify operators →

What did app teams want to learn from operators in October?

App teams posted 21 new projects on app store research in October: 13 research calls and 8 sales calls. Most research calls paid $100 for 30 minutes, within a range of $90 to $150. Sales calls, where the operator gets a product demo, paid $250 to $350.

Paid marketing led. Two projects covered Meta ads, one an AI agent looking for Google Shopping wins before Black Friday, and one ads written from real customer conversations. The rest looked at an AI CMO that runs marketing end to end, AI analytics across Shopify, Klaviyo, GA4 and the ad platforms, and how teams turn marketing decisions into revenue.

Retention was close behind, and it ran deeper than October’s count: three September projects on brand mobile apps and push notifications kept recruiting all month. Late-September projects on fulfillment and 3PL claims, reorder forecasting and apparel size charts stayed open too.

AI ran through all of it. Seven of the 21 new projects were built around an AI product, from voice agents and chat to an AI analyst and an AI visibility tool for ChatGPT, Gemini and Perplexity. Audiences ranged from 78 matching operators for a tightly targeted analytics demo to 2,472 for a Klaviyo deliverability study.

One project went straight at our own audience: how merchants look for apps, which features they compare and how they choose between them.

What did operators tell us they need?

The operators on the other side of those calls pointed the same way. Several wanted the systems they already run joined up rather than replaced, including one who wants “one consistent revenue view” across six platforms.

They’re also willing to switch. In one week, five of fifteen were swapping out a paid tool within 30 days, and others are using AI to make tools of their own. In another, five of twelve wanted growth without paying for traffic.

The sharpest case was a supplements brand that gets around 85% of its new customers from Meta while acquisition costs climb everywhere. Read next to October’s projects, the ask is plain: tools that cut dependence on one channel, or connect what a store already runs.

What’s new on app store research?

Three changes on our side, all aimed at better matches between operators and app teams.

Brand records. From early November, operators in the network get a brand record that gathers their app reviews in one place. Jon set out the reasons on LinkedIn. Operators can get paid for referrals and insight calls, flag the challenges they want help with so app teams reach out warm, and give other brands context when they choose apps.

The fourth reason is accountability. A brand that leaves poor reviews again and again now has a record behind them, and an app team can see it. In Jon’s words: “Bad star ratings are ok, but without context they are useless.”

Buying intent signals. Operators now update their priorities every month, so app teams see who’s looking for what before they reach out. Jon’s name for it is “Zero party data”: information operators choose to share themselves, rather than data pieced together about them.

Jobs board. Our Shopify jobs board lists hand-picked ecommerce roles at brands, agencies and app companies, sourced daily. More than 140 roles went up in October, most of them at brands. Jon now shares each week’s new projects and jobs on LinkedIn too, tagging the teams behind them.

Operator reviews of the apps themselves live in Shopify App Reviews. To see the research that’s live now, browse active projects. And if you missed last month’s changes, the September issue covers Stocky, Meta’s AI channel and the new analytics baseline.

Quick answers: Shopify in October 2026

When was Shopify’s Fall ’26 Edition released? October 28, 2026, with more than 150 updates, including a rebuilt Sidekick, Shopify Protect, seven new local payment methods and checkout in Google AI Mode and Gemini.

Were Shopify stores hacked in October 2026? Some stores had shoppers redirected to fake checkouts from October 10, through code delivered via installed apps’ settings rather than Shopify’s checkout itself. Shopify added redirect protection on October 20 and tightened it on October 23.

Is Google AI Mode checkout on by default for Shopify stores? Yes, for eligible stores, rolling out to customers in the US, Canada and Australia. You can turn it off under Sales channels, Agentic.

When does the Shopify Knowledge Base app shut down? January 15, 2027. Its replacement is built into the admin under Sales channels, Agentic, Knowledge base.

When must Shopify apps use expiring offline access tokens? By January 1, 2027. Unmigrated public apps are delisted that day, and non-expiring tokens stop working on April 1, 2027.

What did Shopify app teams research with operators in October 2026? Paid marketing led, with 7 of the 21 new projects on app store research, ahead of retention (5) and customer contact (4). Seven of the 21 were built around an AI product.

Sources: Shopify Editions Fall ’26, Shopify Changelog, Shopify developer changelog, Shopify Help Center (Google AI Mode and Gemini, Rollouts requirements), Shopify developer blog on app security, all retrieved November 2026.

Platform figures cover the 21 research and sales projects app teams posted on app store research between October 1 and October 31, 2026, plus jobs board listings added that month. Operator insights come from our ASR Weekly newsletter, and Jon Kennedy’s comments from ShopOps Weekly and his LinkedIn posts.

Check Shopify’s own documentation before you act on any policy detail here. Last reviewed: November 3, 2026.